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DECLARATION OF HUGH HUETTNER 
PURSUANT TO 28 U.S.C. § 1746 


I, Hugh Huettner, hereby state that I have personal knowledge of the facts and matters set 


forth below, and if called as a witness, would testify competently thereto: 


I ama U.S. citizen over the age of eighteen years old. 


2. Iam a Technical Computer Forensic Examiner for the U.S. Federal Trade 
Commission (FTC) in Washington, DC. My duties include managing the collection, 
preservation, examination, and analysis of evidentiary electronically stored information (“ESI”), 


which the FTC collects through voluntary submissions, discovery, and legal proceedings. 


3. Prior to working for the FTC, I was employed by the Department of Commerce 
(DOC), Office of Export Enforcement (OEE), in Washington DC as a Computer Forensic 
Analyst. As a Computer Forensic Analyst, my duties included providing support, advice and 
investigative guidance to DOC OEE criminal investigators and managers. Additionally, my 


duties included preserving, collecting, and analyzing digital evidence. 
4. Ihave a Bachelor of Arts degree in Business Administration from the University of 
Maryland University College and an Associates degree in Criminal Justice from Lassen 


Community College. 


5. lam a epraduate of the Apprentice Special Agent’s Course (ASAC) sponsored by the 


U.S. Army Criminal Investigation Command and the Criminal Investigator Training Program 
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(CITP) sponsored by the U.S. Department of Homeland Security, Federal Law Enforcement 


Training Center (FLETC). 


6. Iam certified by the U.S. Department of Homeland Security as a Seized Computer 
Evidence Recovery Specialist (SCERS) and Computer Network Investigations Training Program 
(CNITP). 

7. [have completed formal classroom training in the use of forensic software programs 
from Guidance Software (Encase) and the Access Data Corporation Forensic Tooikit (FTK). 
Encase and FTK are two computer forensic software packages that are generally accepted by the 
scientific community for use in acquiring, processing and analyzing ESI. I have met the 
requirements for the EnCase Certified Examiner (EnCE) program and was awarded the 


certification. 


8. [ have earned the following Information Technology certifications as well: Comp TIA 
A+ and Comp TIA Network+. Addittonally, I took the Multi Certificate course from 
Georgetown University in Arlington, VA which focused in A+, Network+, Security+, Microsoft 


Certified Professional (MCP), and CCNA. 


9. As a forensic examiner for the FTC, my job duttes include providing computer 
forensic support to FTC attorneys and FTC investigators. In the course of my duties, | was 


assigned to work on the case of FTC v. Butterfly Labs (the “BFL Matter”). 
10. As part of my duties in this case, on September 19, 2014, I sent two FTC contract 


computer forensic examiners to Defendants’ premises in Overland Park, Kansas, pursuant to the 


Court’s Temporary Restraining Order (“TRO”), dated September 18, 2014, which granted the 
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Commission immediate access to such premises. Jason Sweeney and Joe Carbon, CACI 
Forensic Examiners, went to the business premises located at 10770 El Monte Street, Suite 101, 
Overland Park, KS 66211. I was the Digital Evidence Manager for all the forensic acquisitions 


in the execution of this TRO. 


11. Jason Sweeney and Joe Carbon created either a logical copy or a forensic image of 
servers and computers designated by the FTC case team and the receiver. Put simply, a logical! 
copy of a computer is a copy of certain selected files within a hard drive, while a forensic image 


is a full copy of the physical hard drive. 


12. After all the forensic images were created of the designated computers, Sweeney 


returned to Washington, DC hand carrying the evidence and signed them over to me. 


13. On or about September 20, 2014, the forensic images were verified that the ESI on 
the images had not been altered since the time the forensic examiner had obtained them by 
verifying on an FTC forensic computer that the hash value (a unique numerical representation of 


a piece of data), for each image was the same as when the forensic examiner copied the data. 


14. A forensic working copy of each image was made, user created files were exported; 
and the files were provided to the FTC eDiscovery section who made specific files available to 
the case team for them to conduct a review. 


Executed on this 25" day of September 2014, in Washjngton, DC. 


Hugh Huettner 
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